[Bug 10368] New: Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

Summary: Corel Draw X3 Won't Install
           Product: Wine
           Version: 0.9.48.
          Platform: PC
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: wine-msi
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

Created an attachment (id=9041)
 --> (http://bugs.winehq.org/attachment.cgi?id=9041)
Log of the error

The installation is failing when the second stage start.

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

Lei Zhang  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |Installer

--- Comment #1 from Lei Zhang   2007-11-09 12:40:09 ---
does the trial version have the same problem?

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

--- Comment #2 from Jaime Rave   2007-11-09 12:42:29 ---
Iget this bug with the trial version.

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

James Hawkins  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download

--- Comment #3 from James Hawkins   2007-11-09 13:08:16 ---
Awesome.

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

James Hawkins  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |INVALID

--- Comment #4 from James Hawkins   2007-12-02 21:01:13 ---
Thanks for checking if the same thing happens in Windows or not....it does.

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

James Hawkins  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |UNCONFIRMED
         Resolution|INVALID                     |

--- Comment #5 from James Hawkins   2007-12-02 21:02:00 ---
Anger directed at wrong bug.

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

James Hawkins  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|wine-msi                    |wine-misc

--- Comment #6 from James Hawkins   2007-12-21 17:44:12 ---
This is not a bug in msi.  The problem is that the preliminary installer calls
MsiInstallProduct on CorelPreInstall.msi.  There are several properties sent in
to this installer (taken from a run in Windows),

ACTIONTODO="AcquireKey"
MAIN_INSTALL_DLG_TITLE="Setup Initialization"
SERIALNUMBER="DR13WTX-9999998-YSP"
...

Before calling the sub-installer, the installer sets the title of the main
window to "Setup Initialization".  The sub-installer then calls FindWindowA
using the value of the MAIN_INSTALL_DLG_TITLE passed in to MsiInstallProduct. 
The problem is that the command line is corrupted in Wine:

"ACTIONTODO="AcquireKey" MAIN_INSTALL_DLG_TITLE="Setup
Initialization\0010\000b\00a1 SERIALNUMBER="DR13WTX-9999998-YS USERNAME=...

Notice the extra bytes on MAIN_INSTALL_DLG_TITLE and the missing end-quote on
that and SERIALNUMBER.  The sub-installer ends up calling FindWindowA("Setup
Initialization\0010\000b\00a1 SERIALNUMBER=") which loops endlessly.  If you
set warn+heap, the second parameter to MsiInstallProduct is \00aa\00aa\00aa...
so there's some corruption on the part of the Corel custom action CA_Callit
that gets lucky enough to not mess up in Windows.  Punt.

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

Tom Ingberg  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #7 from Tom Ingberg   2008-01-27 14:40:36 ---
So, is there any workaround or suggestions how to install CorelDraw X3?

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

James Hawkins  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #8 from James Hawkins   2008-01-30 14:39:18 ---
*** Bug 11404 has been marked as a duplicate of this bug. ***

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

Saulo Toledo  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #9 from Saulo Toledo   2008-03-06 06:16:24 ---
Here I have the same. CorewDraw X3 stops on "Setup Initialization" and doesn't
installs. Trial version here.

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

Lei Zhang  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|0                           |1

--- Comment #10 from Lei Zhang   2008-03-06 10:02:30 ---
confirming

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

aljosa gomilsek  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #11 from aljosa gomilsek   2008-05-31 09:46:00 ---
I have the same problem on my original CD. Any fix?

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #12 from Anastasius Focht   2008-08-09 05:51:36 ---
Hello,

random pick of the day ;-)
I downloaded the X3 trial version.
James' analysis (comment #6) is correct so far.

Sub-installer custom action "CA_AcquireKey" fails due to MAIN_INSTALL_DLG_TITLE
containing garbage.
And yes, custom action "CA_Callit" which builds the action string contains some
code which looks like subtile application bug.

In short: Differences in Wine and Windows heap block management let this app
succeed in Windows - despite an application bug.

Following is the stack before a sequence of internal installer function calls
which ultimately lead to the bug:

--- snip ---
$+0   7ED445F8  ptr 009D0B28
$+4   1001C830  "%s SERIALNUMBER="%s""
$+8   009D0B28  "ACTIONTODO="AcquireKey" MAIN_INSTALL_DLG_TITLE="Setup
Initialization""
$+C   7ED44604  "DR13WTX-9999998-YSP"
..
--- snip ---

$+0 = pointer to destination buffer address (dest = heap allocated)
$+4 = format string
$+8 = first vararg parameter for format string call (heap allocated)
$+C = second vararg parameter for format string call (stack allocated)

Notice how the destination buffer address is actually the same as first vararg
parameter (part of problem).

Lets dissect the memory block of interest.
I formatted all memory blocks in single dword format which makes them easier to
read/comment (address | DWORD value | ASCII reprs. | comment).

--- snip #1 ---
(wine heap block header)
009D0B10   00000058  X...  ; ARENA_INUSE.size
009D0B14   02455355  USE.  ; ARENA_INUSE.unused_bytes, ARENA_INUSE.magic
(app internal buffer part)
009D0B18   10027450  Pt..  ; vtable pointer for some string manager
009D0B1C   00000045  E...  ; length of currently used data
009D0B20   00000045  E...  ; length of allocated data
009D0B24   00000001  ....  ; reference count for this string object
009D0B28   49544341  ACTI  ; begin of string buffer
..
009D0B68   6E6F6974  tion
009D0B6C   50410022  ".AP
--- snip #1 ---

Following is the first free block which is of interest (there is an in-use
block between both not of interest).

--- snip #2 ---
..
009D0BA0   00000221  !...  ; ARENA_FREE.size
009D0BA4   45455246  FREE  ; ARENA_FREE.magic
009D0BA8   009D00F8  ø.. ; ARENA_FREE.list_entry.FLink
009D0BAC   009D00E8  è.. ; ARENA_FREE.list_entry.BLink
009D0BB0   6F646E69  indo
...
--- snip #2 ---

Within the buggy sequence, a reallocation happens, hence the memory block
layout is as follows:

First memory block (which was previously allocated):

--- snip #3 ---
009D0B10   00000051  Q...  ; ARENA_FREE.size
009D0B14   45455246  FREE  ; ARENA_FREE.magic
009D0B18   009D00B8  ... ; ARENA_FREE.list_entry.FLink
009D0B1C   009D00A8  ... ; ARENA_FREE.list_entry.BLink

009D0B20   00000045  E...
009D0B24   00000001  ....
009D0B28   49544341  ACTI
..
009D0B68   6E6F6974  tion
009D0B6C   009D0B10  ... ; 
--- snip #3 ---

Directly after (re)allocation:
Previously free, now newly allocated block to hold the result data.

--- snip #4 ---
009D0BA0   000000A0  ....
009D0BA4   05455355  USE.
009D0BA8   10027450  Pt..
009D0BAC   00000045  E...
009D0BB0   0000008A  Š...
009D0BB4   00000001  ....
009D0BB8   49544341  ACTI
009D0BBC   4F544E4F  ONTO
009D0BC0   223D4F44  DO="
009D0BC4   75716341  Acqu
009D0BC8   4B657269  ireK
009D0BCC   20227965  ey"
009D0BD0   4E49414D  MAIN
009D0BD4   534E495F  _INS
009D0BD8   4C4C4154  TALL
009D0BDC   474C445F  _DLG
009D0BE0   5449545F  _TIT
009D0BE4   223D454C  LE="
009D0BE8   75746553  Setu
009D0BEC   6E492070  p In
009D0BF0   61697469  itia
009D0BF4   617A696C  liza
009D0BF8   6E6F6974  tion
009D0BFC   69570022  ".Wi
...
--- snip #4 ---

And the same block after bug sequence:

--- snip #5 ---
009D0BA0   000000A0  ....
009D0BA4   05455355  USE.
009D0BA8   10027450  Pt..
009D0BAC   00000045  E...
009D0BB0   0000008A  Š...
009D0BB4   00000001  ....
009D0BB8   49544341  ACTI
..
009D0BF0   61697469  itia
009D0BF4   617A696C  liza
009D0BF8   6E6F6974  tion
009D0BFC   209D0B10  ..
009D0C00   49524553  SERI
009D0C04   554E4C41  ALNU
009D0C08   5245424D  MBER
009D0C0C   5244223D  ="DR
009D0C10   54573331  13WT
009D0C14   39392D58  X-99
009D0C18   39393939  9999
009D0C1C   53592D38  8-YS
009D0C20   00002250  P"..
..
--- snip #5 ---

Ok, that's a lot of heap block dumps ... let me explain what happens.

I'll provide a pseudo code sequence which I think resembles the bug behaviour.
It might not be 100% accurate, just to illustrate the problem.

Consider the following snippet:

--- pseudo code ---
void format_string_memfn( const char* formatstring, ...)
{
    va_list ap;
    va_start( ap, formatstring);

int required_length = get_required_length_for_format_operation(
formatstring, ap);
    if( internal_string_buffer.length < required_length)
        reallocate_internal_buffer( required_length);

vsnprintf( internal_string_buffer, required_length, formatstring, ap);
    va_end(ap);
}

// instanciate string class object
some_string_class str;
..
// do some formatstring ops on string object
// str's internal buffer now contains "ACTIONTODO="AcquireKey"
MAIN_INSTALL_DLG_TITLE="Setup Initialization"

// I am evil
str.format_string_memfn( "%s SERIALNUMBER="%s"", (const char*) str,
"DR13WTX-9999998-YSP");

--- pseudo code ---

The internal format function checks if the expected result buffer size of
format operation is larger than internal storage.
If so, it reallocates the internal buffer (while preserving the content).
snippet #3 = previously allocated heap block, now marked free
snippet #4 = new buffer

The string format operation then copies the data into newly allocated buffer.

Now the problem: noticed the first vararg parameter?
It's actually a "raw" pointer to the internal representation of the string
buffer - at the time before the function call.
Most string classes provide such "operator const char * () const" to get a C
string representation of underlying object.
This means that even after internal reallocation to new heap block, the old
storage is still referenced by this parameter/pointer (va_list).

When the string copying for the first vararg param occurs, the old (now freed)
block contents are copied.
If you look closely at snippet #3 last DWORD you see "009D0B10".
It's actually a back pointer, set by Wine's heap manager when the block has
been marked as free. A part of string data has been overwritten.
The string copy operation copies until it encounters null terminator, hence
this back pointer data is taken as string data (see "209D0B10" data in snippet
#5).

Because Wine's heap manager is actually touching the data area by writing the
back pointer value to last 4 bytes when it marks the block as "free", the data
integrity is not preserved.
This behaviour is completely valid because application shall not touch the old
block anymore.
I can only guess that Windows heap manager preserves the old storage until next
heap calls/consolidation which lets this application succeed despite this nasty
bug.
If heap managers would clear heap blocks by default I guess many applications
will not work anymore due to such brain damaged code ;-)

I won't provide a patch here.
Wine's heap manager is something Julliard probably wants to fix himself.

Just a hint: if you keep the back pointer for free blocks at this place
(directly before the next arena header), provide sizeof(ARENA_FREE*) more
storage, to not let the back pointer overwrite data parts.

I already tested it - works ;-)
If this bug is fixed, you'll run into bug 2547
I'll have a look into that too ...

Regards

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

--- Comment #13 from Anastasius Focht   2008-08-10 05:11:01 ---
Hello,

if this bug is fixed there is another bug until it hits bug 2547
I filed it separately here: bug 14817

Regards

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

--- Comment #14 from Jaime Rave   2008-09-25 22:46:28 ---
I have tested with Wine 1.1.5 and it's getting a little further. But don't know
now if this bug is fixed and i'm hitting bug 2547 or bug 14817.

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

Jaime Rave  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |http://www.download32.com/go
                   |                            |/16181/http%3A%2F%2Fwww.core
                   |                            |l.com%2Fakdlm%2F6763%2Fdownl
                   |                            |oads%2Ftrials%2FGraphicsSuit
                   |                            |eX3%2FEN%2FCorelDRAWGraphics
                   |                            |SuiteX3.exe/

--- Comment #15 from Jaime Rave   2008-12-05 17:36:21 ---
Still a problem in Wine 1.1.9

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

Jaime Rave  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|http://www.download32.com/go%7Chttp://www.corel.com/akdlm/6
                   |/16181/http%3A%2F%2Fwww.core|763/downloads/trials/Graphic
                   |l.com%2Fakdlm%2F6763%2Fdownl|sSuiteX3/EN/CorelDRAWGraphic
                   |oads%2Ftrials%2FGraphicsSuit|sSuiteX3.exe
                   |eX3%2FEN%2FCorelDRAWGraphics|
                   |SuiteX3.exe/                |

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

Matthew Millar  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #16 from Matthew Millar   2008-12-09 18:16:14 ---
Error still present in Wine 1.1.10 using Ubuntu 8.10 x86_64

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

--- Comment #17 from Alistair Leslie-Hughes   2009-01-13 22:29:04 ---
Still an issue.

Backtrace:
=>0 0x6106b95d get_node+0x2d(This=0x2000e98, nsnode=0x1d6efc, create=1)
[/home/alesliehughes/wine/dlls/mshtml/htmlnode.c:924] in mshtml (0x0033fa7c)
  1 0x610513e3 HTMLDocument_get_all+0x73(iface=0x2000ea8, p=<register EDI not
in topmost frame>) [/home/alesliehughes/wine/dlls/mshtml/htmldoc.c:290] in
mshtml (0x0033fabc)

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

Jonata Bolzan  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #18 from Jonata Bolzan   2009-07-08 07:12:16 ---
Error still present in Wine 1.1.25, Ubuntu 9.04

Stop and don't go ahead in "Publishing Product Information" stage, but the
files are installed normaly.

When trying to execute CorelDRW.exe from program files directory, a message
shows "The UI Language Registration is invalid" sometimes, and CorelDRAW
crashes.

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

--- Comment #19 from Jonata Bolzan   2009-07-20 05:44:12 ---
Error still present in Wine 1.1.26, Ubuntu 9.04

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

--- Comment #20 from Jonata Bolzan   2009-08-10 05:59:44 ---
Error still present in Wine 1.1.27, Ubuntu 9.04

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

[e-mail] changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #21 from [e-mail]  2009-09-19 13:34:35 ---
CorewDraw X3 stops on "Setup Initialization" and doesn't installs.
:( Hope this gets fixed, this is the only thing holding me to windows

Wine has been installed from within the latest version of Ubuntu Netbook Remix
9.04 installed 3 days back. I am more or less transitioned from windows to
Ubuntu except for Coreldraw X3 !!!

Really hoping for X3 upwards versions of Coreldraw to move into the Platinum
Win apps category !!!

Anything in sight for the 1.2 release ?

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

--- Comment #22 from Jonata Bolzan   2009-11-03 03:44:14 ---
Error still present in Wine 1.1.32, Ubuntu 9.04

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

--- Comment #23 from Jonata Bolzan   2010-02-18 04:00:53 ---
Error still present in Wine 1.1.38, Ubuntu 9.10

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

--- Comment #24 from Jonata Bolzan   2010-07-13 06:33:47 ---
Error still present in Wine 1.2-rc7, Ubuntu 10.04 64bit

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

--- Comment #25 from Jonata Bolzan  2010-09-13 06:45:25 CDT ---
Error not present in Wine 1.3.2, Ubuntu 10.04 64bit!

Now the installer go ahead in "Publishing Product Information" stage.

But still, when trying to execute CorelDRW.exe from program files directory, a
message shows "The UI Language Registration is invalid" sometimes, and
CorelDRAW
crashes.

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

--- Comment #26 from Jonata Bolzan  2010-09-14 06:59:36 CDT ---
Status of this bug can change, this bug was fixed in Wine 1.3.2

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

Dan Kegel  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #27 from Dan Kegel  2010-09-14 07:04:10 CDT ---
Reported fixed.

Please open another bug report for the new problem, if there isn't one already.

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #28 from Alexandre Julliard  2010-09-18 13:06:33 CDT ---
Closing bugs fixed in 1.3.3.

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

--- Comment #29 from Jonata Bolzan  2010-12-28 07:21:28 CST ---
This bug is back in Wine 1.3.9. Tested in Ubuntu 10.10 64bit

[Bug 10368] Corel Draw X3 Won't Install

http://bugs.winehq.org/show_bug.cgi?id=10368

--- Comment #30 from Jeff Zaroyko  2010-12-28 16:05:46 CST ---
(In reply to comment #29)
> This bug is back in Wine 1.3.9. Tested in Ubuntu 10.10 64bit

That would be a new bug, please file a new one and include the result of your
regression test.

[Bug 10368] Corel Draw X3 Won't Install

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=10368

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|http://www.corel.com/akdlm/ |https://web.archive.org/web
                   |6763/downloads/trials/Graph |/20111216220006/http://www.
                   |icsSuiteX3/EN/CorelDRAWGrap |corel.com/akdlm/6763/downlo
                   |hicsSuiteX3.exe             |ads/trials/GraphicsSuiteX3/
                   |                            |EN/CorelDRAWGraphicsSuiteX3
                   |                            |_dlm.exe